

Application No. 


Applicant(s) 




Notice of Allowability 


09/916,969 


CAMBRIDGE ETAL 


Examiner 


Art Unit 






Jeffrey D. Popham 


2137 





- The MAILING DATE of this communication appears on the cover sheet with the correspondence address* 
Alt claims being allowable, PROSECUTION ON THE MERITS IS (OR REMAINS) CLOSED in this application. If not included 
herewith (or previously mailed), a Notice of Allowance (PTOL-85) or other appropriate communication will be mailed in due course. THIS 
NOTICE OF ALLOWABILITY IS NOT A GRANT OF PATENT RIGHTS. This application is subject to withdrawal from issue at the initiative 
of the Office or upon petition by the applicant. See 37 CFR 1.313 and MPEP 1308. 

1 . ^ This communication is responsive to 4/01/2005 . 

2. [El The allowed claim(s) is/are 1-19 . 

3. ^ The drawings filed on 26 July 2001 are accepted by the Examiner. 

4. □ Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 

a) □ All b)DSome* c) □ None of the: 

1. □ Certified copies of the priority documents have been received. 

2. □ Certified copies of the priority documents have been received in Application No. . 

3. □ Copies of the certified copies of the priority documents have been received in this national stage application from the 

International Bureau (PCT Rule 17.2(a)), 
* Certified copies not received: . 

Applicant has THREE MONTHS FROM THE "MAILING DATE" of this communication to file a reply complying with the requirements 
noted below. Failure to timely comply will result in ABANDONMENT of this application. 
THIS THREE-MONTH PERIOD IS NOT EXTENDABLE. 

5. □ A SUBSTITUTE OATH OR DECLARATION must be submitted. Note the attached EXAMINER'S AMENDMENT or NOTICE OF 

INFORMAL PATENT APPLICATION (PTO-152) which gives reason(s) why the oath or declaration is deficient. 

6. □ CORRECTED DRAWINGS ( as "replacement sheets") must be submitted. 

(a) □ including changes required by the Notice of Draftsperson's Patent Drawing Review ( PTO-948) attached 

1) □ hereto or 2) □ to Paper No./Mail Date . 

(b) □ including changes required by the attached Examiner's Amendment / Comment or in the Office action of 

Paper No./Mail Date . 

Identifying indicia such as the application number (see 37 CFR 1.84(c)) should be written on the drawings in the front (not the back) of 
each sheet. Replacement sheet(s) should be labeled as such in the header according to 37 CFR 1 .1 21(d). 

7. □ DEPOSIT OF and/or INFORMATION about the deposit of BIOLOGICAL MATERIAL must be submitted. Note the 

attached Examiner's comment regarding REQUIREMENT FOR THE DEPOSIT OF BIOLOGICAL MATERIAL. 



Attachment(s) 

1 . □ Notice of References Cited (PTO-892) 

2. □ Notice of Draftperson's Patent Drawing Review (PTO-948) 

3. □ Information Disclosure Statements (PTO-1449 or PTO/SB/08) 

Paper No./Mail Date 

4. □ Examiner's Comment Regarding Requirement for Deposit 

of Biological Material 



5. □ Notice of Informal Patent Application (PTO-152) 

6. S Interview Summary (PTO-413), 

Paper No./Mail Date 20050513 . 

7. Examiner's Amendment/Comment 

8. □ Examiner's Statement of Reasons for Allowance 

9. □ Other . 

ANDREW CALDWELL 
SUPERVISORY PATENT EXAMINER 



U.S. Patent and Trademark Office 
PTOL-37 (Rev. 1-04) 



Notice of Allowability 



Part of Paper No./Mail Date 20050513 



Application/Control Number: 09/916,969 Page 2 

Art Unit: 2137 

EXAMINER'S AMENDMENT 



An examiner's amendment to the record appears below. Should the 
changes and/or additions be unacceptable to applicant, an amendment may be 
filed as provided by 37 CFR 1.312. To ensure consideration of such an 
amendment, it MUST be submitted no later than the payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone 
interview with Kevin Zilka on 5/13/2005. 



Please amend the claims as follows: 
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Amended claims follow: 

1. (Previously Presented) A method for responding to a virus alert, the virus 
alert containing information pertaining to a new virus, the method comprising: 

receiving the virus alert; 

assessing a risk level associated with the new virus, the assessing 
including: obtaining information associated with at least one previous virus which 
has caused a previous infection on a computer system, and comparing the 
information pertaining to the new virus with the information associated with the 
previous virus which has cause the previous infection on the computer system; 
and 

obtaining a program code based on the risk level; 

wherein the previous virus and the new virus are of a first type, and the 
information associated with the previous virus which has caused the previous 
infection on the computer system includes data associated with a duration of the 
previous infection and a scope of the previous infection. 

2. -4. (Cancelled) 

5. (Previously Presented) The method as recited in claim 1 wherein the 
information associated with the previous virus which has caused the previous 
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infection on the computer system is stored in a profile on a database associated 
with the computer system. 

6. (Original) The method as recited in claim 1 wherein the virus alert is 
received from an anti-virus information source. 

7. (Original) The method as recited in claim 6 wherein the virus alert is 
automatically received from the anti-virus information source. 

8. (Original) The method as recited in claim 7 wherein receiving the virus 
alert includes acquiring the virus alert from the anti-virus information source. 

9. (Original) The method as recited in claim 1 wherein the computer system 
is a computer network, the computer network including a plurality of computing 
devices. 

10. (Previously Presented) A computer program product responding to a virus 
alert, the virus alert being arranged to provide information pertaining to a new 
virus, the computer program product comprising: 

computer code for receiving the virus alert; 

computer code for assessing a risk level associated with the new virus, 
the assessing including: obtaining information associated with at least one 
previous virus which has caused a previous infection on a computer system, and 
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comparing the information pertaining to the new virus with the information 
associated with the previous virus which has caused the previous infection on the 
computer system; 

computer code for obtaining program code based on the risk level; and 
a computer-readable medium that stores the computer codes; 
wherein the previous virus and the new virus are of a first type, and the 
information associated with the previous virus which has caused the previous 
infection on the computer system includes data associated with a duration of the 
previous infection and a scope of the previous infection. 

11. (Cancelled) 

12. (Cancelled) 

13. (Currently Amended) The computer program product as recited in claim 
10 wherein the computer-readable medium is one selected from the group 
consisting of a hard disk, a CD-ROM, a DVD, a computer disk, a tape drive, and 
a computer memory[[,]] and a data signa l e mbodi e d in a carr ie r wav e. 

14. (Previously Presented) A computer system suitable for responding to a 
virus alert, the virus alert being providing information pertaining to a new virus, 
the computer system comprising: 

computer code for receiving the virus alert; 
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computer code for assessing a risk level associated with the new virus, 
the assessing including: obtaining information associated with at least one 
previous virus which has caused a previous infection on the computer system, 
and comparing the information pertaining to the new virus with the information 
associated with the previous virus which has caused the previous infection on the 
computer system; 

computer code for obtaining code based on the risk level; 

a computer-readable medium that stores the computer codes; and 

a processor that executes the computer codes; 

wherein the previous virus and the new virus are of a first type, and the 
information associated with the previous virus which has caused the previous 
infection on the computer system includes data associated with a duration of the 
previous infection and a scope of the previous infection. 

15.-57. (Cancelled) 

58. (Previously Presented) The computer program product as recited in claim 
10 wherein the information associated with the previous virus which has caused 
the previous infection on the computer system is stored in a profile on a database 
associated with the computer system. 

59. (Previously Presented) The computer program product as recited in claim 
10 wherein the virus alert is received from an anti-virus information source. 
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60. (Previously Presented) The computer program product as recited in claim 

59 wherein the virus alert is automatically received from the anti-virus information 
source. 

61 . (Previously Presented) The computer program product as recited in claim 

60 wherein receiving the virus alert includes acquiring the virus alert from the 
anti-virus information source. 

62. (Previously Presented) The computer program product as recited in claim 
10 wherein the computer system is a computer network, the computer network 
including a plurality of computing devices. 

63. (Cancelled) 

64. (Previously Presented) The computer system as recited in claim 14 
wherein the information associated with the previous virus which has caused the 
previous infection on the computer system is stored in a profile on a database 
associated with the computer system. 

65. (Previously Presented) The computer system as recited in claim 14 
wherein the virus alert is received from an anti-virus information source. 
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66. (Previously Presented) The computer system as recited in claim 65 
wherein the virus alert is automatically received from the anti-virus information 
source. 

67. (Previously Presented) The computer system as recited in claim 66 
wherein receiving the virus alert includes acquiring the virus alert from the anti- 
virus information source. 

68. (Previously Presented) The computer system as recited in claim 14 
wherein the computer system is a computer network, the computer network 
including a plurality of computing devices. 
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Conclusion 

Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to Jeffrey D. Popham whose telephone number 
is (571)-272-7215. The examiner can normally be reached on M-F 9:00-5:30. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Andrew Caldwell can be reached on (571)-272-3868. 
The fax phone number for the organization where this application or proceeding 
is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from 
the Patent Application Information Retrieval (PAIR) system. Status information 
for published applications may be obtained from either Private PAIR or Public 
PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see http://pair- 
direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll- 
free). 

ANDREW CALDWELL 
SUPERVISORY PATENT EXAMINER 



